Overview

overview

10

Static

static

10

LEmu Downl...or.exe

windows7-x64

7

LEmu Downl...or.exe

windows10-2004-x64

7

Resubmissions

14-01-2024 21:31

240114-1c7xfaebc9 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LEmu Download.zip

  • Size

    159.9MB

  • Sample

    240114-1c7xfaebc9

  • MD5

    db84f1e4d65f81d8ed489ee0512920d6

  • SHA1

    5c8435bf33d80db18f48792aa5a1ec222f30215f

  • SHA256

    0101981095cefb1272f7cc27dfe55ac8d0b1417c79dd7d6fdcbaddd917649986

  • SHA512

    2b7861d7a1b4df6fec676c32f5fb993e0f68c2a314ee10d0d319a52fdf776dedf7c8b0c7598f69308adeeca4b0ab140868766ee24b6f984cad12c24f57662bf7

  • SSDEEP

    3145728:fRXu7bZwSB2usuKm3ELCJg9KUhMDWfn5oXBmJ4NAhY49ZX3+noi2lHQSO:psZw42kELCJg9VqcSAy49gnoi2NQz

Score
10/10
crealstealerpyinstallerspywarestealer

Malware Config

Targets

    • Target

      LEmu Download/NitroGenerator.exe

    • Size

      14.7MB

    • MD5

      5734f0e4d4f3206f635f4956f2f6d8b7

    • SHA1

      ed907967147a9fae785084c5a7538ec86667114a

    • SHA256

      afefa950275a01596246bc734f8e010c314a713d79c2f20f3a460c59352f9b42

    • SHA512

      46126f1427f790907454e745b857721b81392d32bb560ef5e6a6cb3eeb62260072554fa63cad811b45d3b9537e77a2d9553ddf9e5c3628a56b0fe875c15d4b10

    • SSDEEP

      393216:qwvpEkZQMidQuslSq99oWOv+9fgriEt8nUdw:qUphQ3dQuSDorvSYriPn/

    Score
    7/10
    spywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks